Re: A question for the list...

From: Kevin Reardon (Kevin.Reardon_at_oracle.com)
Date: 05/21/03

  • Next message: Justin Pryzby: "Re: Scans from proxyprotector.com" 
    Date: Wed, 21 May 2003 10:25:49 -0700
To: Tom Vande Stouwe <tomv@conpro.net>, incidents@securityfocus.com

    Please keep these discussions directed toward the email list, it's
    supposed to be a general conversation.

    Ignorance of the Law is no excuse, but it does not imply a mandatory use
    of vigilantism as a response. In the case where a landlord is notified
    and they do nothing, the police and regional prosecutors will have
    something to say about it. If the neighbor, on the other hand, responds
    in some manner, even if it is the same response the police would do,
    they would be guilty of several offenses (and rightly so because it
    would not be the actions of a "reasonable man"). Again, we use police
    to enforce the laws, removing the burden (and hopefully the arbitrary
    reactions of vigilantism) from the general users of society.

    ---K

    Tom Vande Stouwe wrote:
    >
    > To extend your analogy, If you are the landlord, and a neighbor calls
    > you and tells you your tenant had put a drug slot in the front door and
    > you do nothing, are you still innocent? Vulnerabilities are all over
    > the net, and no on that runs a server can say 'I did not know'. Here we
    > say 'Ignorance of the Law is no excuse' and when you accept the
    > responsibility for being a landlord (or server admin) you accept the
    > responsibility for its proper use within the constraints of 'average
    > person' restrictions.
    >
    > Tom
    >
    > -----Original Message-----
    > From: Kevin Reardon [mailto:Kevin.Reardon@oracle.com]
    > Sent: Tuesday, May 20, 2003 4:15 PM
    > To: Mark Ng
    > Cc: incidents@securityfocus.com
    > Subject: Re: A question for the list...
    >
    > Yes they are innocents. If you rent a house though an agency and they
    > rent it to a crack dealer, and you live in another state, how do you
    > know he is dealing crack? Are you guilty of allowing your premises to
    > be used in an illegal manner? In situations like this, Meat Space uses
    > a trusted third party to enforce the rules (police and the UN
    > sometimes). Such a third party does not exist in Cyberspace, nor with
    > the existing protocols could it without a restructure of OS's or the
    > transport protocols.
    >
    > Automated alerts could become shrapnel in an attack. They could be
    > spoofed, would be subjected to the same software issues any program has
    > (bugs) and even a false alert could send an ISP to chasing its tail.
    >
    > ---K
    >
    > Mark Ng wrote:
    > >
    > > Just 2 cents -
    > >
    > > >
    > > > Is this proposal a vaccine, or could it unleash such collateral
    > damage
    > > > as to make the Internet useless? Keep in mind that the "attackers"
    > are
    > > > more then likely compromised systems, and are thus "innocents." But
    > is
    > >
    > > Are owners of long term compromised systems really "innocents"? If
    > people
    > > have left systems compromised with worms that are attacking other
    > networks
    > > and reports have been ignored for significant amounts of time, then
    > surely
    > > the compromised party are guilty of negligence ?
    > >
    > > Personally, I think there are merits to some kind of "strikeback"
    > system,
    > > but it has worse than dubious legality, and would definitely be abused
    > > (without a question). I think that ISP's need to make a more active
    > role in
    > > this, and actively threaten to cut off customers whos compromised
    > systems
    > > are attacking other networks on the internet.
    > >
    > > Perhaps rather than a strikeback system, something similar to ARIS
    > could be
    > > used to send automated alerts to ISP's warning them that x number of
    > their
    > > customers have the latest worm. In the event that ISP's are
    > non-compliant,
    > > and don't deal with their infected customers, peering points could
    > agree to
    > > enforce this upon ISP's.
    > >
    > > This is much preferable to doing things that may or may not be morally
    > > correct, but are a legal minefield.
    > >
    > > Thoughts ?
    > >
    > > Regards,
    > >
    > > Mark Ng (www.informationintelligence.net)
    >
    > ------------------------------------------------------------------------
    > ----
    > *** Wireless LAN Policies for Security & Management - NEW White Paper
    > ***
    > Just like wired networks, wireless LANs require network security
    > policies
    > that are enforced to protect WLANs from known vulnerabilities and
    > threats.
    > Learn to design, implement and enforce WLAN security policies to
    > lockdown enterprise WLANs.
    >
    > To get your FREE white paper visit us at:
    > http://www.securityfocus.com/AirDefense-incidents
    > ------------------------------------------------------------------------
    > ----

    ----------------------------------------------------------------------------
    *** Wireless LAN Policies for Security & Management - NEW White Paper ***
    Just like wired networks, wireless LANs require network security policies
    that are enforced to protect WLANs from known vulnerabilities and threats.
    Learn to design, implement and enforce WLAN security policies to lockdown enterprise WLANs.

    To get your FREE white paper visit us at:
    http://www.securityfocus.com/AirDefense-incidents
    ----------------------------------------------------------------------------

  • Next message: Justin Pryzby: "Re: Scans from proxyprotector.com"

    Relevant Pages

    • RE: A question for the list...
      ... Are owners of long term compromised systems really "innocents"? ... are attacking other networks on the internet. ... implement and enforce WLAN security policies to lockdown enterprise WLANs. ...
      (Incidents)
    • Re: Why are some people making a big deal. . .
      ... between this law, and the law barring the duplication of movies is ... owner's interest) so they may be more eager to enforce it. ... enforced are the ENFORCERS of the law, not the legislators. ...
      (rec.gambling.poker)
    • RE: A question for the list...
      ... lower than a level you'd need to launch a counter attack. ... On the Internet, a packet must pass through many networks, and ... misses and takes down an unintended host or router, ... > that are enforced to protect WLANs from known vulnerabilities and threats. ...
      (Incidents)
    • Re: Tancredo in Iowa: Enforce the Law on Immigration
      ... The present law provides for deportation for illegals. ... All you need to do is enforce it. ... Root them out, round them up and SEND THEM HOME, a solution you have been told many, many times, which you refuse to believe. ... No, Jerry, it doesn't depend on what WE define a solution as. ...
      (soc.retirement)
    • Whose Side Is Michael Chertoff On?
      ... Whose Side Is Michael Chertoff On? ... "We're going to continue to enforce the law. ... on the so-called "comprehensive immigration reform" bill late last ...
      (alt.politics.bush)